A Behavioral Detection and Monitoring Framework for Ransomware Using Splunk SIEM and MITRE ATT&CK: The Hive Case Study
Year: 2026
Type: conference-paper
Abstract: The persistent escalation of ransomware-related incidents constitutes a critical existential threat to the security infrastructure of contemporary digital organizations. This study proposes and validates a comprehensive analytical model for the proactive detection, visualization, and taxonomic categorization of adversarial security events. By integrating the Splunk Enterprise Security Information and Event Management (SIEM) platform with the MITRE ATT&CK framework, the research establishes a robust methodology for monitoring the Hive ransomware variant as a primary case study. The process encompasses the ingestion of heterogeneous telemetry and historical forensic records, which are then normalized through structured Search Processing Language (SPL) algorithms. A central component of the framework is the deployment of dynamic dashboards based on Splunk’s Simple XML schema, allowing for real-time visualization of Command-and-Control spikes, resource consumption anomalies, and unauthorized administrative activities. Findings demonstrate that focusing detection efforts on “Defense Evasion” (T1562) and “Impact” (T1490) significantly enhances cyber-resilience. Quantitative analysis of the generated telemetry confirms that behavioral mapping significantly reduces the detection window during the pre-encryption phase.
Authors: Jefferson Acán, Soraya Sinche, Pablo Hidalgo
Institution: National Polytechnic School
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7225177751